CyberCertPrepOT Security FundamentalsOT Fundamentals: Network Architecture & ProtocolsEASYFree question
An OT architect must decide where to place a patch/update staging server that downloads vendor patches from the internet and serves them to control-zone engineering stations. The appropriate placement is:
- A.Inside Level 1 next to the PLCs for quick deployment
- B.In the Level 3.5 DMZ, where it can receive patches from outside and be polled by control-zone hosts without a direct internet path to OT
- C.On the corporate LAN with a route opened straight into the control zone
- D.On the same host as the safety controller to centralize updates
Why B is correct
A patch staging server is a broker: it pulls updates from the enterprise/internet side and control-zone hosts retrieve from it, all within the DMZ. This avoids giving control-zone systems any direct internet path.
Know someone studying for OT Security Fundamentals? Send them this one.